pg.ddx.io pgsql-admin@postgresql.org mailing list archivehelp / color / mirror / Atom feed
Enabling Windows Authentication 2+ messages / 2 participants [nested] [flat]
* Enabling Windows Authentication @ 2012-03-11 06:07 Noel Simela <nsimela@gmail.com> 2012-03-16 08:35 ` Re: Enabling Windows Authentication Christian Ullrich <chris@chrullrich.net> 0 siblings, 1 reply; 2+ messages in thread From: Noel Simela @ 2012-03-11 06:07 UTC (permalink / raw) To: pgsql-admin Hi all, I am working on an Analysis cube that gathers data directly from a Postgres 8.4 db connected via PGNP data source. Problem is I can't browse the cube because my windows credentials are not authenticated on the postgres server.How do I enable this? The postgres server is hosted on Windows 2008 Server platform. Sent from my Windows Phone ^ permalink raw reply [nested|flat] 2+ messages in thread
* Re: Enabling Windows Authentication 2012-03-11 06:07 Enabling Windows Authentication Noel Simela <nsimela@gmail.com> @ 2012-03-16 08:35 ` Christian Ullrich <chris@chrullrich.net> 0 siblings, 0 replies; 2+ messages in thread From: Christian Ullrich @ 2012-03-16 08:35 UTC (permalink / raw) To: pgsql-admin; +Cc: nsimela@gmail.com * Noel Simela wrote: > I am working on an Analysis cube that gathers data directly from a > Postgres 8.4 db connected via PGNP data source. PGNP is based on libpq, so it should work the same way as for ODBC. > Problem is I can't browse the cube because my windows credentials are > not authenticated on the postgres server.How do I enable this? > > The postgres server is hosted on Windows 2008 Server platform. If you are in a domain environment, read on. Otherwise, it does not work at all. Very short guide to configuring PostgreSQL on Windows for SSPI ============================================================== 1. Requirements - The server and all client systems must belong to the same domain. (I expect it also works if the server's domain does at least trust the clients', but I have never tried that.) - All client processes must likewise run under a domain account. No local user accounts on client systems can authenticate to the server. - The clients must connect to the server using the FQDN (Fully Qualified Domain Name) to avoid Kerberos complications. 2. Server Configuration 1. Create a service account in the domain for the PostgreSQL service. 2. Stop the PostgreSQL service. 3. Assign the required SPN (Service Principal Name) to the service account: setspn -A postgres/<Server FQDN> <Service Account> 4. Reconfigure the service to log on as the new service account. 5. Change ownership and permissions of the data directory and its contents so they belong to the service account and it has full control. 6. Add the required entries to pg_hba.conf with authentication method "sspi". Keep a line for a superuser with a different auth method above the SSPI lines, so you can get in even if it does not work right. 7. Start the PostgreSQL service. You can use the "klist" command on the clients to check whether they get service tickets from the domain controller. Good luck. -- Christian Ullrich ^ permalink raw reply [nested|flat] 2+ messages in thread
end of thread, other threads:[~2012-03-16 08:35 UTC | newest] Thread overview: 2+ messages (download: mbox mbox.gz follow: Atom feed) -- links below jump to the message on this page -- 2012-03-11 06:07 Enabling Windows Authentication Noel Simela <nsimela@gmail.com> 2012-03-16 08:35 ` Christian Ullrich <chris@chrullrich.net>
This inbox is served by DDX for PostgreSQL; see mirroring instructions for how to clone and mirror all data and code used for this inbox